Master Password

The Master Password protects access to the Runeya interface when you want to prevent any unauthorized access from localhost.

How It Works

Browser
    │  POST /auth/login { password }
    ▼
 Server
    │  Argon2id hash compare
    │  Signed JWT (24h)
    ▼
 Browser stores JWT
    │  Authorization: Bearer <jwt>
    ▼
 tRPC protectedProcedure ← validates JWT

1. The password is hashed with Argon2id (resistant to GPUs and side-channel attacks)
2. A pepper is stored in the OS keychain (outside ./.runeya/) to strengthen the hash
3. The AES-256 encryption key is derived from the password + pepper
4. A signed JWT is issued for the session (24h validity)

Setting a Master Password

1. Go to Settings → Security
2. Click "Set a password"
3. Enter and confirm your password
4. Save

On next interface launch, a login screen will appear.

Resetting the Password

Secret loss

If you reset the master password, encrypted secrets (variables with secret: true) will be inaccessible as the encryption key changes. Export your secrets before any reset.

To reset:

runeya reset-password

This command deletes the password hash and regenerates the encryption key. Services continue to work but their secret variables will need to be re-entered.

Without a Master Password

In local-simple mode without a configured password, the interface is accessible without authentication from localhost. This is the default behavior, suitable for solo development.

Keychain Security

The pepper is stored in:

• macOS: Keychain Services
• Linux: Secret Service (GNOME Keyring / KWallet)
• Windows: Windows Credential Manager

This means that even if ./.runeya/ is copied to another machine, secrets remain unreadable without the original machine's keychain pepper.